Sanket Shelar created RANGER-5678:
-------------------------------------
Summary: Concurrent policy-engine rebuild on shared serviceDef
causes CME/NPE for delegated-admin User
Key: RANGER-5678
URL: https://issues.apache.org/jira/browse/RANGER-5678
Project: Ranger
Issue Type: Bug
Components: Ranger
Affects Versions: 3.0.0
Reporter: Sanket Shelar
Assignee: Sanket Shelar
Under concurrent delegated-admin V2 API(
{baseUrl}/service/public/v2/api/service/\{service-name}/policy) load (policy
LIST + CREATE/UPDATE/DELETE), multiple Tomcat threads rebuild the policy engine
for the same service (e.g. cm_hive) in parallel. Each rebuild calls
ServiceDefUtil.normalize() *in-place* on the *same* serviceDef object from
RangerServicePoliciesCache.
This causes:
* ConcurrentModificationException in normalizeDataMaskDef /
normalizeRowFilterDef
* NullPointerException
* getPolicyAdmin(<service>): failed to get latest policies from service-store
{code:java}
026-07-08 09:31:19,045 ERROR org.apache.ranger.biz.RangerPolicyAdminCache:
[https-jsse-nio-6182-exec-15]: getPolicyAdmin(cm_hive): failed to get latest
policies from service-store
java.util.ConcurrentModificationException
at java.util.ArrayList$Itr.checkForComodification(ArrayList.java:909)
at java.util.ArrayList$Itr.next(ArrayList.java:859)
at
org.apache.ranger.plugin.util.ServiceDefUtil.normalizeDataMaskDef(ServiceDefUtil.java:319)
at
org.apache.ranger.plugin.util.ServiceDefUtil.normalize(ServiceDefUtil.java:97)
at
org.apache.ranger.plugin.policyengine.RangerPolicyRepository.<init>(RangerPolicyRepository.java:187)
at
org.apache.ranger.plugin.policyengine.RangerPolicyRepository.<init>(RangerPolicyRepository.java:180)
at
org.apache.ranger.plugin.policyengine.PolicyEngine.<init>(PolicyEngine.java:225)
at
org.apache.ranger.biz.RangerPolicyAdminImpl.<init>(RangerPolicyAdminImpl.java:96)
at
org.apache.ranger.biz.RangerPolicyAdminCache.addPolicyAdmin(RangerPolicyAdminCache.java:199)
at
org.apache.ranger.biz.RangerPolicyAdminCache.addOrUpdatePolicyAdmin(RangerPolicyAdminCache.java:166)
at
org.apache.ranger.biz.RangerPolicyAdminCache.getServicePoliciesAdmin(RangerPolicyAdminCache.java:103)
at
org.apache.ranger.biz.RangerPolicyAdminCacheForEngineOptions.getServicePoliciesAdmin(RangerPolicyAdminCacheForEngineOptions.java:73)
at
org.apache.ranger.biz.RangerPolicyAdminCacheForEngineOptions.getServicePoliciesAdmin(RangerPolicyAdminCacheForEngineOptions.java:54)
at
org.apache.ranger.rest.ServiceREST.getPolicyAdminForDelegatedAdmin(ServiceREST.java:3969)
{code}
{code:java}
2026-07-08 09:31:23,401 ERROR org.apache.ranger.biz.RangerPolicyAdminCache:
[https-jsse-nio-6182-exec-13]: getPolicyAdmin(cm_hive): failed to get latest
policies from service-store
java.lang.NullPointerException
at
org.apache.ranger.plugin.model.validation.RangerServiceDefHelper$Delegate.isValid(RangerServiceDefHelper.java:509)
at
org.apache.ranger.plugin.model.validation.RangerServiceDefHelper$Delegate.<init>(RangerServiceDefHelper.java:346)
at
org.apache.ranger.plugin.model.validation.RangerServiceDefHelper.<init>(RangerServiceDefHelper.java:157)
at
org.apache.ranger.plugin.model.validation.RangerServiceDefHelper.<init>(RangerServiceDefHelper.java:127)
at
org.apache.ranger.plugin.policyengine.RangerPolicyRepository.init(RangerPolicyRepository.java:880)
at
org.apache.ranger.plugin.policyengine.RangerPolicyRepository.<init>(RangerPolicyRepository.java:229)
at
org.apache.ranger.plugin.policyengine.RangerPolicyRepository.<init>(RangerPolicyRepository.java:180)
at
org.apache.ranger.plugin.policyengine.PolicyEngine.<init>(PolicyEngine.java:225)
at
org.apache.ranger.biz.RangerPolicyAdminImpl.<init>(RangerPolicyAdminImpl.java:96)
at
org.apache.ranger.biz.RangerPolicyAdminCache.addPolicyAdmin(RangerPolicyAdminCache.java:199)
at
org.apache.ranger.biz.RangerPolicyAdminCache.addOrUpdatePolicyAdmin(RangerPolicyAdminCache.java:166)
at
org.apache.ranger.biz.RangerPolicyAdminCache.getServicePoliciesAdmin(RangerPolicyAdminCache.java:103)
at
org.apache.ranger.biz.RangerPolicyAdminCacheForEngineOptions.getServicePoliciesAdmin(RangerPolicyAdminCacheForEngineOptions.java:73)
at
org.apache.ranger.biz.RangerPolicyAdminCacheForEngineOptions.getServicePoliciesAdmin(RangerPolicyAdminCacheForEngineOptions.java:54)
at
org.apache.ranger.rest.ServiceREST.getPolicyAdminForDelegatedAdmin(ServiceREST.java:3969)
at
org.apache.ranger.rest.ServiceREST.applyAdminAccessFilter(ServiceREST.java:3842)
at
org.apache.ranger.rest.ServiceREST.getServicePolicies(ServiceREST.java:3277)
at
org.apache.ranger.rest.ServiceREST.getServicePoliciesByName(ServiceREST.java:3244)
{code}
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
